Confirming blind bugs with OOB

A blind bug returns nothing in the response — an out-of-band callback is the proof it fired. The Scanner wires this through Oastify (Pro).

A blind bug leaves nothing in the response. A blind SSRF, a blind XML external entity (XXE) attack, an out-of-band (OOB) SQL injection, a server-side template that quietly evaluates — the page comes back normal while something fired on the back end. The proof is the callback: plant a payload that makes the target reach out to a host you control, and when it does, you have the evidence the response never showed.

Oastify is the host that catches those callbacks. This page is how the Scanner drives it — which checks go blind, how a payload carries a unique token home, and how a hit lands as a Finding.

Which checks confirm with OOB

When an OOB server is armed, the Scanner adds blind variants to its active checks. The classes that phone home:

The same wiring backs OOB variants of the email-header, deserialization, file-upload, JWT, reflected-XSS, and stored-XSS checks — 12 active checks in total emit blind payloads when a callback domain is set.

How the callback proves it

1. Arm a payload. The check mints a unique, unguessable token and builds a callback host like {token}.{your-domain}, then plants it where the bug fires — a URL parameter for SSRF, an external entity for XXE, a ${jndi:…} string for Log4Shell.
2. Send it. The Scanner injects it through the flow's insertion points, the same path every other payload takes.
3. Wait for the call home. If the back end takes the bait, it reaches out — a DNS query, an HTTP fetch, an SMTP connection, an LDAP bind. Oastify catches and parses the callback.
4. Correlate. Every callback carries the token, so Hugin ties it back to the exact check and flow that planted it — no guessing from a diffed response.
5. Raise the finding. The confirmed hit becomes a Finding with the callback attached as proof.

The correlation window

A callback can arrive long after the payload — a back-end queue or a scheduled job may fetch the URL minutes later. Hugin holds each pending token for 60 minutes by default and correlates any callback that lands inside that window. A hit on a token it no longer holds, or one timestamped before the payload was sent, is dropped as stale.

DNS is the most reliable signal, then HTTP, then SMTP/LDAP/FTP/SMB — a target that can't make an outbound HTTP request but can still resolve a hostname gives you a DNS hit.

What the finding carries

The Finding arrives with the callback as evidence:

Confidence climbs with the evidence. A callback on the protocol the check expected, plus a repeat hit or a callback under 5 seconds, grades it Certain; a single hit on the expected protocol, or two hits on any protocol, is Firm; a lone, slow, off-protocol hit is Tentative. Severity follows the channel — HTTP, HTTPS, LDAP, and SMB callbacks come in Critical, DNS, SMTP, and FTP High.

Turn it on

Point the Scanner at an OOB server first, or the blind variants have nowhere to call:

• Oastify runs the listeners in-app — nothing to deploy.
• Self-hosting the OOB server keeps every callback on a domain you own, and answers protocols the in-app server doesn't.

Then run a scan as usual — see Active and passive checks. Findings that fired blind arrive backed by a real callback instead of a guess.

Last updated 2026-06-17.